Threats affecting pkg:github/Parabol

CVE-2026-125748 is an authorization bypass vulnerability in Parabol versions before 15.21.2. It affects the addReactjiToReactable GraphQL mutation, allowing authenticated users to manipulate reactions on content belonging to other organizations by pairing their own meetingId with another tenant's reactableId. This enables unauthorized addition or removal of reactions on reflections, comments, or sequential team prompt responses.